https://community.splunk.com/t5/Getting-Data-In/Reconcile-hosts-from-multiple-timezones-in-splunk/m-p/169930#M34340 <P>Hey everyone. <BR /> I'm wondering how this is possible to accomplish - we have windows server farms across numerous timezones. They all send data to the same group of indexers, which convert everything to UTC. </P> <P>If all of the windows servers are configured to use their local timezones, but the indexers only have a single props.conf file overriding time zones, how can we specify different time zones for the different servers? </P> <P>Is it possible to override at the outputs.conf level on the forwarder itself, so I can effectively send out a small app to all of my forwarders that specifies "all hosts, send your data as if it was UTC"?</P> <P>Everything specifies that this has to be overridden at the input level, but only a single timezone can be specified for a particular input. If you have servers from two timezones sending the same type of input, there needs to be an additional way to specify.</P> <P>Obviously the best way to do this would to have all of the windows farms running UTC, but it's not my environment, so I can't really dictate that to another team.</P> Fri, 06 Dec 2013 16:10:42 GMT msarro 2013-12-06T16:10:42Z https://community.splunk.com/t5/Getting-Data-In/Reconcile-hosts-from-multiple-timezones-in-splunk/m-p/169930#M34340 <P>Hey everyone. <BR /> I'm wondering how this is possible to accomplish - we have windows server farms across numerous timezones. They all send data to the same group of indexers, which convert everything to UTC. </P> <P>If all of the windows servers are configured to use their local timezones, but the indexers only have a single props.conf file overriding time zones, how can we specify different time zones for the different servers? </P> <P>Is it possible to override at the outputs.conf level on the forwarder itself, so I can effectively send out a small app to all of my forwarders that specifies "all hosts, send your data as if it was UTC"?</P> <P>Everything specifies that this has to be overridden at the input level, but only a single timezone can be specified for a particular input. If you have servers from two timezones sending the same type of input, there needs to be an additional way to specify.</P> <P>Obviously the best way to do this would to have all of the windows farms running UTC, but it's not my environment, so I can't really dictate that to another team.</P> Fri, 06 Dec 2013 16:10:42 GMT https://community.splunk.com/t5/Getting-Data-In/Reconcile-hosts-from-multiple-timezones-in-splunk/m-p/169930#M34340 msarro 2013-12-06T16:10:42Z https://community.splunk.com/t5/Getting-Data-In/Reconcile-hosts-from-multiple-timezones-in-splunk/m-p/169931#M34341 <P>I have the same question, did you ever get anywhere with this?</P> <P><A href="http://answers.splunk.com/answers/130913/splunk-and-different-timezones">http://answers.splunk.com/answers/130913/splunk-and-different-timezones</A></P> Wed, 09 Apr 2014 02:50:12 GMT https://community.splunk.com/t5/Getting-Data-In/Reconcile-hosts-from-multiple-timezones-in-splunk/m-p/169931#M34341 conor_splunk 2014-04-09T02:50:12Z